From: Sasha Levin Date: Sun, 23 Aug 2020 01:16:34 +0000 (-0400) Subject: Fixes for 5.7 X-Git-Tag: v4.4.234~62 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=bf7f242eae1ffc9aba833b174c247e52242e8f95;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.7 Signed-off-by: Sasha Levin --- diff --git a/queue-5.7/bcache-avoid-nr_stripes-overflow-in-bcache_device_in.patch b/queue-5.7/bcache-avoid-nr_stripes-overflow-in-bcache_device_in.patch new file mode 100644 index 00000000000..6efcf94806f --- /dev/null +++ b/queue-5.7/bcache-avoid-nr_stripes-overflow-in-bcache_device_in.patch @@ -0,0 +1,62 @@ +From b8dd3dff4e5775897f0b0b61365af2bdd1466766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Jul 2020 20:00:21 +0800 +Subject: bcache: avoid nr_stripes overflow in bcache_device_init() + +From: Coly Li + +[ Upstream commit 65f0f017e7be8c70330372df23bcb2a407ecf02d ] + +For some block devices which large capacity (e.g. 8TB) but small io_opt +size (e.g. 8 sectors), in bcache_device_init() the stripes number calcu- +lated by, + DIV_ROUND_UP_ULL(sectors, d->stripe_size); +might be overflow to the unsigned int bcache_device->nr_stripes. + +This patch uses the uint64_t variable to store DIV_ROUND_UP_ULL() +and after the value is checked to be available in unsigned int range, +sets it to bache_device->nr_stripes. Then the overflow is avoided. + +Reported-and-tested-by: Ken Raeburn +Signed-off-by: Coly Li +Cc: stable@vger.kernel.org +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1783075 +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/md/bcache/super.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index b4d23d9f30f9b..d5477faa14edd 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -825,19 +825,19 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, + struct request_queue *q; + const size_t max_stripes = min_t(size_t, INT_MAX, + SIZE_MAX / sizeof(atomic_t)); +- size_t n; ++ uint64_t n; + int idx; + + if (!d->stripe_size) + d->stripe_size = 1 << 31; + +- d->nr_stripes = DIV_ROUND_UP_ULL(sectors, d->stripe_size); +- +- if (!d->nr_stripes || d->nr_stripes > max_stripes) { +- pr_err("nr_stripes too large or invalid: %u (start sector beyond end of disk?)", +- (unsigned int)d->nr_stripes); ++ n = DIV_ROUND_UP_ULL(sectors, d->stripe_size); ++ if (!n || n > max_stripes) { ++ pr_err("nr_stripes too large or invalid: %llu (start sector beyond end of disk?)\n", ++ n); + return -ENOMEM; + } ++ d->nr_stripes = n; + + n = d->nr_stripes * sizeof(atomic_t); + d->stripe_sectors_dirty = kvzalloc(n, GFP_KERNEL); +-- +2.25.1 + diff --git a/queue-5.7/drm-panel-simple-fix-inverted-v-h-sync-for-frida-frd.patch b/queue-5.7/drm-panel-simple-fix-inverted-v-h-sync-for-frida-frd.patch new file mode 100644 index 00000000000..4d8c654deae --- /dev/null +++ b/queue-5.7/drm-panel-simple-fix-inverted-v-h-sync-for-frida-frd.patch @@ -0,0 +1,43 @@ +From 38d15e8f9ab32cb20db922b6b9f3e373367dd7df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 14:56:46 +0200 +Subject: drm/panel-simple: Fix inverted V/H SYNC for Frida FRD350H54004 panel + +From: Paul Cercueil + +[ Upstream commit bad20a2dbfdfaf01560026909506b6ed69d65ba2 ] + +The FRD350H54004 panel was marked as having active-high VSYNC and HSYNC +signals, which sorts-of worked, but resulted in the picture fading out +under certain circumstances. + +Fix this issue by marking VSYNC and HSYNC signals active-low. + +v2: Rebase on drm-misc-next + +Fixes: 7b6bd8433609 ("drm/panel: simple: Add support for the Frida FRD350H54004 panel") +Cc: stable@vger.kernel.org # v5.5 +Signed-off-by: Paul Cercueil +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200716125647.10964-1-paul@crapouillou.net +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 346e3f9fd505a..a68eff1fb4297 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1537,7 +1537,7 @@ static const struct drm_display_mode frida_frd350h54004_mode = { + .vsync_end = 240 + 2 + 6, + .vtotal = 240 + 2 + 6 + 2, + .vrefresh = 60, +- .flags = DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC, ++ .flags = DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC, + }; + + static const struct panel_desc frida_frd350h54004 = { +-- +2.25.1 + diff --git a/queue-5.7/drm-vgem-replace-opencoded-version-of-drm_gem_dumb_m.patch b/queue-5.7/drm-vgem-replace-opencoded-version-of-drm_gem_dumb_m.patch new file mode 100644 index 00000000000..f99eef88a19 --- /dev/null +++ b/queue-5.7/drm-vgem-replace-opencoded-version-of-drm_gem_dumb_m.patch @@ -0,0 +1,83 @@ +From 163648267f5aaf65ecfab783c30f7b4dcc40c301 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 16:49:11 +0100 +Subject: drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() + +From: Chris Wilson + +[ Upstream commit 119c53d2d4044c59c450c4f5a568d80b9d861856 ] + +drm_gem_dumb_map_offset() now exists and does everything +vgem_gem_dump_map does and *ought* to do. + +In particular, vgem_gem_dumb_map() was trying to reject mmapping an +imported dmabuf by checking the existence of obj->filp. Unfortunately, +we always allocated an obj->filp, even if unused for an imported dmabuf. +Instead, the drm_gem_dumb_map_offset(), since commit 90378e589192 +("drm/gem: drm_gem_dumb_map_offset(): reject dma-buf"), uses the +obj->import_attach to reject such invalid mmaps. + +This prevents vgem from allowing userspace mmapping the dumb handle and +attempting to incorrectly fault in remote pages belonging to another +device, where there may not even be a struct page. + +v2: Use the default drm_gem_dumb_map_offset() callback + +Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces") +Signed-off-by: Chris Wilson +Reviewed-by: Daniel Vetter +Cc: # v4.13+ +Link: https://patchwork.freedesktop.org/patch/msgid/20200708154911.21236-1-chris@chris-wilson.co.uk +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_drv.c | 27 --------------------------- + 1 file changed, 27 deletions(-) + +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index 909eba43664a2..204d1df5a21d1 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -229,32 +229,6 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, + return 0; + } + +-static int vgem_gem_dumb_map(struct drm_file *file, struct drm_device *dev, +- uint32_t handle, uint64_t *offset) +-{ +- struct drm_gem_object *obj; +- int ret; +- +- obj = drm_gem_object_lookup(file, handle); +- if (!obj) +- return -ENOENT; +- +- if (!obj->filp) { +- ret = -EINVAL; +- goto unref; +- } +- +- ret = drm_gem_create_mmap_offset(obj); +- if (ret) +- goto unref; +- +- *offset = drm_vma_node_offset_addr(&obj->vma_node); +-unref: +- drm_gem_object_put_unlocked(obj); +- +- return ret; +-} +- + static struct drm_ioctl_desc vgem_ioctls[] = { + DRM_IOCTL_DEF_DRV(VGEM_FENCE_ATTACH, vgem_fence_attach_ioctl, DRM_RENDER_ALLOW), + DRM_IOCTL_DEF_DRV(VGEM_FENCE_SIGNAL, vgem_fence_signal_ioctl, DRM_RENDER_ALLOW), +@@ -448,7 +422,6 @@ static struct drm_driver vgem_driver = { + .fops = &vgem_driver_fops, + + .dumb_create = vgem_gem_dumb_create, +- .dumb_map_offset = vgem_gem_dumb_map, + + .prime_handle_to_fd = drm_gem_prime_handle_to_fd, + .prime_fd_to_handle = drm_gem_prime_fd_to_handle, +-- +2.25.1 + diff --git a/queue-5.7/khugepaged-adjust-vm_bug_on_mm-in-__khugepaged_enter.patch b/queue-5.7/khugepaged-adjust-vm_bug_on_mm-in-__khugepaged_enter.patch new file mode 100644 index 00000000000..6f28fa66cee --- /dev/null +++ b/queue-5.7/khugepaged-adjust-vm_bug_on_mm-in-__khugepaged_enter.patch @@ -0,0 +1,51 @@ +From 6765a4a623b33651dfd2603bd347ebda774f4963 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 17:42:02 -0700 +Subject: khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() + +From: Hugh Dickins + +[ Upstream commit f3f99d63a8156c7a4a6b20aac22b53c5579c7dc1 ] + +syzbot crashes on the VM_BUG_ON_MM(khugepaged_test_exit(mm), mm) in +__khugepaged_enter(): yes, when one thread is about to dump core, has set +core_state, and is waiting for others, another might do something calling +__khugepaged_enter(), which now crashes because I lumped the core_state +test (known as "mmget_still_valid") into khugepaged_test_exit(). I still +think it's best to lump them together, so just in this exceptional case, +check mm->mm_users directly instead of khugepaged_test_exit(). + +Fixes: bbe98f9cadff ("khugepaged: khugepaged_test_exit() check mmget_still_valid()") +Reported-by: syzbot +Signed-off-by: Hugh Dickins +Signed-off-by: Andrew Morton +Acked-by: Yang Shi +Cc: "Kirill A. Shutemov" +Cc: Andrea Arcangeli +Cc: Song Liu +Cc: Mike Kravetz +Cc: Eric Dumazet +Cc: [4.8+] +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008141503370.18085@eggly.anvils +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/khugepaged.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 9e7cec2840927..cb17091d0a202 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -435,7 +435,7 @@ int __khugepaged_enter(struct mm_struct *mm) + return -ENOMEM; + + /* __khugepaged_exit() must not run from under us */ +- VM_BUG_ON_MM(khugepaged_test_exit(mm), mm); ++ VM_BUG_ON_MM(atomic_read(&mm->mm_users) == 0, mm); + if (unlikely(test_and_set_bit(MMF_VM_HUGEPAGE, &mm->flags))) { + free_mm_slot(mm_slot); + return 0; +-- +2.25.1 + diff --git a/queue-5.7/khugepaged-khugepaged_test_exit-check-mmget_still_va.patch b/queue-5.7/khugepaged-khugepaged_test_exit-check-mmget_still_va.patch new file mode 100644 index 00000000000..d9eb5ec5915 --- /dev/null +++ b/queue-5.7/khugepaged-khugepaged_test_exit-check-mmget_still_va.patch @@ -0,0 +1,60 @@ +From 9f869065c86b003ab703840bb8bb6320d780a4ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 23:26:25 -0700 +Subject: khugepaged: khugepaged_test_exit() check mmget_still_valid() + +From: Hugh Dickins + +[ Upstream commit bbe98f9cadff58cdd6a4acaeba0efa8565dabe65 ] + +Move collapse_huge_page()'s mmget_still_valid() check into +khugepaged_test_exit() itself. collapse_huge_page() is used for anon THP +only, and earned its mmget_still_valid() check because it inserts a huge +pmd entry in place of the page table's pmd entry; whereas +collapse_file()'s retract_page_tables() or collapse_pte_mapped_thp() +merely clears the page table's pmd entry. But core dumping without mmap +lock must have been as open to mistaking a racily cleared pmd entry for a +page table at physical page 0, as exit_mmap() was. And we certainly have +no interest in mapping as a THP once dumping core. + +Fixes: 59ea6d06cfa9 ("coredump: fix race condition between collapse_huge_page() and core dumping") +Signed-off-by: Hugh Dickins +Signed-off-by: Andrew Morton +Cc: Andrea Arcangeli +Cc: Song Liu +Cc: Mike Kravetz +Cc: Kirill A. Shutemov +Cc: [4.8+] +Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008021217020.27773@eggly.anvils +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/khugepaged.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 38874fe112d58..9e7cec2840927 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -400,7 +400,7 @@ static void insert_to_mm_slots_hash(struct mm_struct *mm, + + static inline int khugepaged_test_exit(struct mm_struct *mm) + { +- return atomic_read(&mm->mm_users) == 0; ++ return atomic_read(&mm->mm_users) == 0 || !mmget_still_valid(mm); + } + + static bool hugepage_vma_check(struct vm_area_struct *vma, +@@ -1016,9 +1016,6 @@ static void collapse_huge_page(struct mm_struct *mm, + * handled by the anon_vma lock + PG_lock. + */ + down_write(&mm->mmap_sem); +- result = SCAN_ANY_PROCESS; +- if (!mmget_still_valid(mm)) +- goto out; + result = hugepage_vma_revalidate(mm, address, &vma); + if (result) + goto out; +-- +2.25.1 + diff --git a/queue-5.7/series b/queue-5.7/series new file mode 100644 index 00000000000..59dcffef277 --- /dev/null +++ b/queue-5.7/series @@ -0,0 +1,5 @@ +drm-vgem-replace-opencoded-version-of-drm_gem_dumb_m.patch +drm-panel-simple-fix-inverted-v-h-sync-for-frida-frd.patch +khugepaged-khugepaged_test_exit-check-mmget_still_va.patch +khugepaged-adjust-vm_bug_on_mm-in-__khugepaged_enter.patch +bcache-avoid-nr_stripes-overflow-in-bcache_device_in.patch